4 ms·

> if someone obtains access to your Google Account, all of your 2FA secrets would be compromised. This overlooks that fact Google itself also has access to yo

by nomilk 4y ago

> if someone obtains access to your Google Account, all of your 2FA secrets would be compromised. This overlooks that fact Google itself also has access to your 2FA secrets, which could be even worse considering Google could be requested to peer not just into the user's google account, but into accounts they have with other companies/organisations too.

Rookie42 4y ago
Hey, I am about to start writing a position paper covering Social login providers the company should enable/support. Do you have any references you can share for the above comment please ?
gojomo 4y ago
Under what conditions do you suggest "Google itself also has access to all your 2FA secrets"? (Without cloud backup, & without the installation of a malicious version of 'Google Authenticator', how would they – especially, say, on iOS?)
- cogitoergofutuo 4y ago
  I think they are referring to the scenario where cloud backup is enabled.
  - gojomo 4y ago
    Aha, thanks. But, if the 2FA secrets were end-encrypted as the top link suggests, Google then wouldn't in fact have them - so the ggp-comment accusation that the link "overlooks" this factor is nonsensical. (And if Google were denied access to the cleartext 2FA secrete this, way, then briefly compromising someone's Google account – say by hacking or abuse of legal process – wouldn't automatically compromise all other 2FA-key-protected accounts.)
olliej 4y ago
Why would google have access to that material? Is their general secret mechanism not E2EE? I'm fairly cynical on google's approach to privacy but I would be shocked if they're normal syncing isn't actually secure and private.
- judge2020 4y ago
  Chrome passwords are encrypted with your Google password by default, it's just not e2ee. This isn't even encrypted in that way it seems. The only real "threat" is your Google account itself being compromised by a third party able to phish their way into your account or bypass your 2fa mechanisms (e.g. by SMS sim swapping). As always, https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ The people here saying "privacy" are speaking of some doomsday scenario where Google itself leaks all of this data, which would be unprecedented and is unlikely with how many safeguards there are for employees to access any user data at all within Google.
  - Thorrez 4y ago
    >Chrome passwords are encrypted with your Google password by default, it's just not e2ee. Source?
    - judge2020 4y ago
      Chrome settings -> sync -> encryption
      - Thorrez 4y ago
        I believe that's off by default (even when you turn on sync), and I believe that if you do turn it on, it's not using your Google password, but a separate password of your choosing.
  - lern_too_spel 4y ago
    Chrome sync has let you set a separate password for end to end encryption for as long as I can remember, though badly until January 2020. https://bugs.chromium.org/p/chromium/issues/detail?id=820976 https://bugs.chromium.org/p/chromium/issues/detail?id=820976
bipson 4y ago
I think this is a little far fetched as a scenario. Under which assumptions should Google be forced to "peer into accounts a user has with other services"? This is not only not enforceable, it would be illegal. Companies can not be enlisted to do such things governmental agencies are doing. How should a company decide what to look for? Google is not the police and can not be made an investigator just-for-fun. FBI's search engine?! Also, you need the first factor. Do you expect Google would also send the "password reset"-request, reset the password, use your 2nd factor... Just to be nice to the authorities? Wild theory if you ask me...
- TechBro8615 4y ago
  Legality doesn't matter when the authorities pull out the magic National Security Letter, slap you with a gag order, and fine you an amount doubling from $50,000 per day until you comply.
  - bipson 4y ago
    Wow. Fine for what? Gag order? Does not help them. Legality? That would count, if it was something I could order them to do, but again, what do you think would happen there? "Dear Google, we know you have user TechBro8615@gmail.com, could you please: - Go through all your data, and gather which Accounts for which services TechBro8615 has - Go through all these accounts TechBro8615 has with every possible service and reset all his passwords with these accounts (without him noticing) - And use the second factor TechBro8615 has to login - Make a user data takeout for all the data TechBro8615 has with all these services - Create an index of this data, because, well we ask you to, although we can't make you do that - Tell us if TechBro8615 likes Cranberry juice??? Legality does matter, if you request something from third parties. Why on earth should Google ever cooperate beyond step 1? Would you do that?!
    - TechBro8615 4y ago
      My comment is referencing what was documented to happen during 2013: the NSA compelled tech companies to turn over user data under threat of jailing the executives and fining the company huge amounts. They don't need to ask Google for data from other companies. They can compel them to provide the passwords or authentication codes which are stored on Google's servers. Or they could just ask for a list of which accounts have a saved password, so they know who to target next with an NSL.

by nomilk 4y ago

Rookie42 4y ago

Hey, I am about to start writing a position paper covering Social login providers the company should enable/support. Do you have any references you can share for the above comment please ?

gojomo 4y ago

Under what conditions do you suggest "Google itself also has access to all your 2FA secrets"? (Without cloud backup, & without the installation of a malicious version of 'Google Authenticator', how would they – especially, say, on iOS?)

cogitoergofutuo 4y ago
I think they are referring to the scenario where cloud backup is enabled.
- gojomo 4y ago
  Aha, thanks. But, if the 2FA secrets were end-encrypted as the top link suggests, Google then wouldn't in fact have them - so the ggp-comment accusation that the link "overlooks" this factor is nonsensical. (And if Google were denied access to the cleartext 2FA secrete this, way, then briefly compromising someone's Google account – say by hacking or abuse of legal process – wouldn't automatically compromise all other 2FA-key-protected accounts.)

olliej 4y ago

Why would google have access to that material? Is their general secret mechanism not E2EE? I'm fairly cynical on google's approach to privacy but I would be shocked if they're normal syncing isn't actually secure and private.

judge2020 4y ago
Chrome passwords are encrypted with your Google password by default, it's just not e2ee. This isn't even encrypted in that way it seems. The only real "threat" is your Google account itself being compromised by a third party able to phish their way into your account or bypass your 2fa mechanisms (e.g. by SMS sim swapping). As always, https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ The people here saying "privacy" are speaking of some doomsday scenario where Google itself leaks all of this data, which would be unprecedented and is unlikely with how many safeguards there are for employees to access any user data at all within Google.
- Thorrez 4y ago
  >Chrome passwords are encrypted with your Google password by default, it's just not e2ee. Source?
  - judge2020 4y ago
    Chrome settings -> sync -> encryption
    - Thorrez 4y ago
      I believe that's off by default (even when you turn on sync), and I believe that if you do turn it on, it's not using your Google password, but a separate password of your choosing.
- lern_too_spel 4y ago
  Chrome sync has let you set a separate password for end to end encryption for as long as I can remember, though badly until January 2020. https://bugs.chromium.org/p/chromium/issues/detail?id=820976 https://bugs.chromium.org/p/chromium/issues/detail?id=820976

bipson 4y ago

I think this is a little far fetched as a scenario. Under which assumptions should Google be forced to "peer into accounts a user has with other services"? This is not only not enforceable, it would be illegal. Companies can not be enlisted to do such things governmental agencies are doing. How should a company decide what to look for? Google is not the police and can not be made an investigator just-for-fun. FBI's search engine?! Also, you need the first factor. Do you expect Google would also send the "password reset"-request, reset the password, use your 2nd factor... Just to be nice to the authorities? Wild theory if you ask me...

TechBro8615 4y ago
Legality doesn't matter when the authorities pull out the magic National Security Letter, slap you with a gag order, and fine you an amount doubling from $50,000 per day until you comply.
- bipson 4y ago
  Wow. Fine for what? Gag order? Does not help them. Legality? That would count, if it was something I could order them to do, but again, what do you think would happen there? "Dear Google, we know you have user TechBro8615@gmail.com, could you please: - Go through all your data, and gather which Accounts for which services TechBro8615 has - Go through all these accounts TechBro8615 has with every possible service and reset all his passwords with these accounts (without him noticing) - And use the second factor TechBro8615 has to login - Make a user data takeout for all the data TechBro8615 has with all these services - Create an index of this data, because, well we ask you to, although we can't make you do that - Tell us if TechBro8615 likes Cranberry juice??? Legality does matter, if you request something from third parties. Why on earth should Google ever cooperate beyond step 1? Would you do that?!
  - TechBro8615 4y ago
    My comment is referencing what was documented to happen during 2013: the NSA compelled tech companies to turn over user data under threat of jailing the executives and fining the company huge amounts. They don't need to ask Google for data from other companies. They can compel them to provide the passwords or authentication codes which are stored on Google's servers. Or they could just ask for a list of which accounts have a saved password, so they know who to target next with an NSL.